Kibana cannot create index pattern

[Terry]

After deleting all indexes using curl -XDELETE http://localhost:9200/_all
I tried to create index pattern again but when I clicked the create button, it didn't response and no index was created. How to fix this problem?

[warkolm (Mark Walkom)]

Index patterns do not create indices, you need to do that in Elasticsearch before Kibana can read them.

[Terry]

I found that there are still indices in elasticsearch. Are these indices constantly generated by elasticsearch from the logs sent from the beat agents?

However, when I clicked the create button, it stay the same with no index pattern created.

Also I found that there are many .hprof files taking a lot of disk space.
C:\Program Files\Elasticsearch\bin\java_pidXXXX.hprof
What are the files for? Can I delete them?

Where are the indices stored?
If I turn on all the beat agents on the logging machines to send logs to the ELK server, the log received will grow continuously. What the house keeping work to do?

[warkolm (Mark Walkom)]

@Terry

Are these indices constantly generated by elasticsearch from the logs sent from the beat agents?

Yes.

@Terry

However, when I clicked the create button, it stay the same with no index pattern created.

Check with _cat/indices please

@Terry

Also I found that there are many .hprof files taking a lot of disk space.

C:\Program Files\Elasticsearch\bin\java_pidXXXX.hprof

What are the files for? Can I delete them?

They are JVM heap dumps, which are not good. You may want to check your logs.

@Terry

Where are the indices stored?

On the local disk.

Check out Elasticsearch Curator.

[Terry]

Can you see any thing wrong?

I can't find the index files? Are they .json files inside the logstash or elasticsearch folder? What is the exact path?

[warkolm (Mark Walkom)]

I'm a little lost, what problem are you trying to solve here?

[Terry]

I tried to add index pattern by command with the following errors. How to fix it?

C:\Script>curl -XPUT http://127.0.0.1:9200/.kibana/index-pattern/filebeat-* -d '
{"title" : "filebeat-", "timeFieldName": "@timestamp"}'
{"error":"Content-Type header [application/x-www-form-urlencoded] is not support
ed","status":406}curl: (7) Failed to connect to port 80: Connection refused
curl: (6) Could not resolve host: filebeat-,
curl: (6) Could not resolve host: timeFieldName
curl: (3) [globbing] unmatched close brace/bracket in column 11

[Terry]

I would like to know what is serving the web page? Why port 80 cannot be connected in this case?

[warkolm (Mark Walkom)]

It's probably easier if you do it via the Kibana UI.

[Terry]

But Kibana UI does not response. What wrong with it?

[Terry]

Issue: Kibana - Can't create index pattern

I am not sure how to do the following. Can provide a more detailed guide of how to execute the command?

1.Create a .kibana-6.1 index based on your existing mappings, but make sure type looks like:
"type": {
"type": "keyword"
},

2.Reindex from .kibana-6 into .kibana-6.1:
POST _reindex
{
"source": {
"index": ".kibana-6"
},
"dest": {
"index": ".kibana-6.1"
}
}

3.Realias
POST /_aliases
{
"actions" : [
{ "add": { "index": ".kibana-6.1", "alias": ".kibana" } },
]
}